<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body dir="auto">
<div>Cyber security disaster recovery plan</div>
<div><br>
</div>
SANS provides weekly summaries (an example is included) on the week’s security news. there are daily updates on the latest vulnerabilities.
<div><br>
</div>
<div>SANS held an industry conference, free to educators, in Melbourne in August.</div>
<div><br>
</div>
<div>Gary<br>
VSV</div>
<div><br>
<div dir="ltr" id="AppleMailSignature">Sent from an iPad PRO</div>
<div dir="ltr"><br>
Begin forwarded message:<br>
<br>
</div>
<blockquote type="cite">
<div dir="ltr"><b>From:</b> SANS NewsBites <<a href="mailto:newsbites@email.sans.org">newsbites@email.sans.org</a>><br>
<b>Date:</b> 14 September 2019 at 4:47:34 am AEST<br>
<br>
<b>Subject:</b> <b>SANS NewsBites Vol. 21 Num. 072 : Russia’s Attack on Ukrainian Power Grid's Goal: Long-Term Physical Damage; Ransomware: New Targets and Baltimore CIO on Indefinite Leave</b><br>
<b>Reply-To:</b> SANS Institute <<a href="mailto:reply-feca117476650475-11678_HTML-106957115-7329836-566@email.sans.org">reply-feca117476650475-11678_HTML-106957115-7329836-566@email.sans.org</a>><br>
<br>
</div>
</blockquote>
<blockquote type="cite">
<div dir="ltr">
<div style="font-family: Arial; font-size: 13px;"><font color="#005880" face="Arial"><span style="font-size: 18px;"><b>Baltimore CIO on Indefinite Leave Following Ransomware Attack</b></span></font></div>
<div style="font-family: Arial; font-size: 13px;"><font face="Arial" style="font-size: 11px;"><b>(September 10 & 11, 2019)</b><br>
</font></div>
<div style="font-family: Arial; font-size: 13px;">Baltimore (Maryland) CIO Frank Johnson is on indefinite leave. Johnson faced substantial criticism following the May 2019 ransomware attack. City officials noted a lack of transparency and communication in the
wake of the attack and said that Johnson had not drawn up a continuity of operations plan for such an incident. The city is still cleaning up and recovering from the estimated $18m in revenue lost and recovery costs. The May attack was the second ransomware
attack to hit Baltimore systems while Johnson was CIO.<br>
</div>
<div style="font-family: Arial; font-size: 13px;"><b>Editor's Note</b><br>
<br>
<font color="878b8f">[<a alias="Alan Paller" conversion="false" data-linkto="https://" href="https://www.sans.org/newsletters/newsbites/editorial-board#alan-paller" style="color:#878b8f;text-decoration:underline;" title="Alan Paller">Paller</a>]</font><br>
In a surprisingly large number of organizations, the ransomware epidemic has brought about a shift from compliance to continuous hygiene. Having a “clean bill of health” from a cybersecurity consultant no longer works. Senior executives know that those reports
were neither comprehensive nor continuous nor sufficient to reflect adequate CISO performance. Cybersecurity hygiene is dull. It’s never ending. But building the partnership between security and IT operations staff that keeps every machine clean enough to
withstand the low-powered attacks is the pathway to senior management support, even after something bad happens.<br>
<br>
<font color="878b8f">[<a alias="Lee Neely" conversion="false" data-linkto="https://" href="https://www.sans.org/newsletters/newsbites/editorial-board#lee-neely" style="color:#878b8f;text-decoration:underline;" title="Lee Neely">Neely</a>]</font><br>
The takeaway here is that this wave of ransomware attacks is making IT disaster preparedness even more important. IT organizations need to not only have a verified recovery plan, but also communication and backup procedures to bridge the gaps while services
are offline. Involving senior management is also critical for support and transparency.<br>
<br>
<font color="878b8f">[<a alias="William Hugh Murray" conversion="false" data-linkto="https://" href="https://www.sans.org/newsletters/newsbites/editorial-board#william-hugh-murray" style="color:#878b8f;text-decoration:underline;" title="William Hugh Murray">Murray</a>]</font><br>
Concur. And I would add that all accepted residual risk must be scrupulously documented.</div>
<div><br>
<b>Read more in:<br>
<font color="117db6">-</font> <a alias="www.baltimorebrew.com/2019/09/10/frank-johnson-baltimores-it-chief-during-the-ransomware-attack-goes-on-leave/" conversion="false" data-linkto="http://" href="http://www.baltimorebrew.com/2019/09/10/frank-johnson-baltimores-it-chief-during-the-ransomware-attack-goes-on-leave/" style="text-decoration:underline;" title="www.baltimorebrew.com/2019/09/10/frank-johnson-baltimores-it-chief-during-the-ransomware-attack-goes-on-leave/">www.baltimorebrew.com</a></b>:
Frank Johnson, Baltimore’s IT chief during the ransomware attack, goes on leave<br>
<b><font color="117db6">-</font> <a alias="statescoop.com/baltimore-cio-on-leave-ransomware/" conversion="false" data-linkto="http://" href="http://statescoop.com/baltimore-cio-on-leave-ransomware/" style="text-decoration:underline;" title="statescoop.com/baltimore-cio-on-leave-ransomware/">statescoop.com</a></b>:
Baltimore CIO, criticized for ransomware response, on leave<br>
<b><font color="117db6">-</font> <a alias="www.govtech.com/people/Baltimore-CIO-Who-Managed-Ransomware-Response-on-Leave.html" conversion="false" data-linkto="http://" href="http://www.govtech.com/people/Baltimore-CIO-Who-Managed-Ransomware-Response-on-Leave.html" style="text-decoration:underline;" title="www.govtech.com/people/Baltimore-CIO-Who-Managed-Ransomware-Response-on-Leave.html">www.govtech.com</a></b>:
Baltimore CIO, Who Managed Ransomware Response, on Leave</div>
</div>
</blockquote>
</div>
IMPORTANT - This email and any attachments may be confidential. If received in error, please contact us and delete all copies. Before opening or using attachments check them for viruses and defects. Regardless of any loss, damage or consequence, whether caused
by the negligence of the sender or not, resulting directly or indirectly from the use of any attached files our liability is limited to resupplying any affected attachments. Any representations or opinions expressed are those of the individual sender, and
not necessarily those of the Department of Education and Training.
</body>
</html>